CVE-2026-50539

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

CVE-2026-50539 Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

CVE-2026-50539

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on "/notification/export/id" allows an authenticated user to download attachments from any notification, including...

CVE-2026-50539 Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

CVE-2026-50539 Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

CVE-2026-50539

The Xibo digital signage platform (prior to version 4.4.3 ) is vulnerable to missing object-level authorization on the /notification/export/{id} endpoint. This flaw allows an authenticated user to download attachments from any notification, including those created by administrators, by iterating ...

EUVD-2026-112139

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

PT-2026-128267

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

CVE-2026-50539: Missing Authorization

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

CVE-2026-110474

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which cou...

CVE-2026-110474 Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which cou...

EUVD-2026-109786

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which cou...

CVE-2026-110474

The CreditNirvana Agentic AI Call Centre application is vulnerable to a security flaw caused by a hardcoded static API Key within the client-side JavaScript bundle. An unauthenticated remote attacker can exploit this by downloading the JavaScript files to extract the key. Once obtained, the attac...

CVE-2026-110474 Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which cou...

PT-2026-123297

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which cou...

CreditNirvana Agentic AI Call Centre encryption issue vulnerability

Versions prior to 2.0.0 of CreditNirvana Agentic AI Call Centre contain an encryption vulnerability. This vulnerability stems from a hard-coded static API key within the client’s JavaScript package. It may allow unauthenticated remote attackers to extract the API key by downloading the client’s...

CVE-2026-83527

creationtimestamp| type| source ---|---|--- 2026-09-08 20:20:29+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-897 2026-09-09 16:45:05+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-ivanti...

CVE-2026-20281

creationtimestamp| type| source ---|---|--- 2026-09-03 08:45:29+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=2046 2026-09-03 08:46:05+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-24 2026-09-03 13:45:12+00:00| seen|...

CVE-2026-54368

CVE-2026-54368 (CentreStack) : CentreStack versions before 17.4 are vulnerable to an SQL injection in GladDBFiles.SearchEx() and SearchExUnder(). An authenticated attacker can supply a crafted x-glad-filter header to the jsondir API endpoint, causing unsanitized interpolation of the Field paramet...

CVE-2026-54368 CentreStack < 17.4 SQL Injection via x-glad-filter Header

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...